SC-200 Mock Exam 88 — 25 Questions

Question 1

You are designing an automation rule in Microsoft Sentinel that should automatically assign incidents to the appropriate analyst based on the incident type. However, the rule fails to assign correctly for some incidents. What should you verify?

Accepted Answer

The order of conditions in the automation rule; ensure more specific conditions are evaluated first.. Automation rules in Microsoft Sentinel evaluate conditions in order, and the first matching condition triggers the associated action. If a broad condition (e.g., 'all incidents') is placed before a more specific condition (e.g., 'incident type equals Phishing'), the broad rule will match first and assign incorrectly, preventing the specific rule from ever running. Reordering conditions so that the most specific ones are evaluated first ensures correct assignment based on incident type.

Answer

That a playbook has been created to perform the assignment.

Answer

That the incident assignment rule in Microsoft Entra ID is configured correctly.

Answer

That the owner (analyst) has the required permissions in Microsoft Sentinel.

Question 2

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a device is identified as compromised by Defender for Endpoint, an incident is automatically created in Sentinel with high severity. What should you configure?

Accepted Answer

Create an automation rule that triggers when an incident is created and set severity to High. Option D is correct because automation rules in Microsoft Sentinel can be configured to run when an incident is created, and they can set the severity of the incident to High. In this scenario, when Defender for Endpoint identifies a compromised device, the Defender XDR connector creates an incident in Sentinel. The automation rule then immediately elevates the severity to High, meeting the requirement without additional manual steps or complex logic.

Answer

Configure the Defender XDR connector to create incidents

Answer

Write an analytics rule that queries Defender for Endpoint data

Answer

Create a playbook to create an incident from the alert

Question 3

Refer to the exhibit. You deploy this ARM template to deploy a saved search in a Microsoft Sentinel workspace. After deployment, the saved search does not appear in Sentinel. What is the most likely reason?

Accepted Answer

The apiVersion is outdated for saved searches in Sentinel.. The apiVersion specified in the ARM template is outdated for saved searches in Microsoft Sentinel. Saved searches require a specific apiVersion (e.g., '2021-04-01' or later) that supports the 'Microsoft.OperationalInsights/workspaces/savedSearches' resource type. An outdated apiVersion can cause the deployment to fail silently or not register the saved search in Sentinel, even if the template syntax is otherwise valid.

Answer

The query syntax is invalid.

Answer

The resource type is incorrect.

Answer

The name parameter is incorrectly formatted.

Question 4

You have deployed Microsoft Defender for Endpoint and integrated it with Microsoft Sentinel. You notice that alerts from Defender for Endpoint are not appearing in Sentinel. What should you check first?

Accepted Answer

Verify that the Microsoft 365 Defender connector in Sentinel is enabled and configured.. The Microsoft 365 Defender connector in Microsoft Sentinel is the specific data connector responsible for ingesting alerts from Microsoft Defender for Endpoint (and other Defender products). If this connector is not enabled or misconfigured, alerts will not flow into Sentinel regardless of licensing, device onboarding, or analytics rules. This is the first and most direct check because the connector acts as the ingestion pipeline.

Answer

Confirm that Defender for Endpoint is licensed for all users.

Answer

Check that the alert severity is not being filtered out by analytics rules.

Answer

Ensure that all devices are onboarded to Defender for Endpoint.

Question 5

You are responsible for Microsoft Defender for Identity. The security team reports that some high-confidence alerts are not triggering any automated response. You need to automate the response for these alerts. What should you configure?

Accepted Answer

In Microsoft Defender XDR, configure automated investigation and response for Identity alerts.. Option C is correct because Microsoft Defender for Identity alerts are natively integrated into Microsoft Defender XDR (formerly Microsoft 365 Defender), which provides automated investigation and response (AIR) capabilities. By configuring AIR for Identity alerts in Defender XDR, you can automatically trigger remediation actions such as suspending compromised accounts or blocking suspicious activities without additional scripting or third-party tools.

Answer

Use Microsoft Intune to trigger a script on domain controllers when an alert fires.

Answer

Create an automation rule in Microsoft Sentinel to respond to Identity alerts.

Answer

Configure Microsoft Purview compliance policies to respond to Identity alerts.

Question 6

Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?

Accepted Answer

ServiceNow connector. The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.

Answer

HTTP connector

Answer

Azure Monitor connector

Answer

Office 365 Outlook connector

Question 7

Your organization uses Microsoft Sentinel. You need to ensure that incident investigation is efficient by automatically grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure alert grouping in the analytics rule wizard. Option B is correct because Microsoft Sentinel's analytics rule wizard includes a dedicated 'Alert grouping' configuration that allows you to specify how alerts from the same analytics rule are automatically combined into a single incident. This setting is essential for efficient incident investigation, as it reduces alert noise by grouping related alerts based on criteria such as matching entities, time windows, or custom alert details, ensuring that security analysts work with consolidated incidents rather than individual alerts.

Answer

Create an automation rule to group alerts

Answer

Use a playbook to merge incidents

Answer

Define a watchlist to consolidate alerts

Question 8

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Option C is correct because automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 9

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Answer

Deploy a data connector

Answer

Modify a watchlist

Answer

Create a scheduled query rule

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that a new SOC analyst can triage incidents without being able to delete or modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Reader. Microsoft Sentinel Reader provides read-only access to Sentinel data, including incidents, workbooks, and analytics rules, but explicitly prevents any modifications or deletions. This role is ideal for SOC analysts who need to triage incidents without altering detection configurations. Security Reader and Global Reader lack Sentinel-specific incident triage permissions, while Security Operator allows modification of incidents, which exceeds the required scope.

Answer

Security Reader

Answer

Global Reader

Answer

Security Operator

Question 11

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to automatically group related incidents from different rules into a single incident to reduce analyst workload. The grouping should occur within 30 minutes of the first incident creation. What should you do?

Accepted Answer

Configure incident grouping in the analytics rule settings with a matching condition and a 30-minute time window.. Option B is correct because Microsoft Sentinel's analytics rules support incident grouping, which automatically merges alerts that match specified conditions (e.g., same entity) into a single incident. By setting the grouping time window to 30 minutes, you ensure that related incidents from different rules are combined within that period, reducing analyst workload without requiring manual intervention or custom playbooks.

Answer

Use an automation rule with a playbook that queries for related incidents and merges them.

Answer

Create an incident creation rule that groups alerts from multiple analytics rules based on entity matching.

Answer

Create a workbook to display related incidents and manually merge them.

Question 12

You are a security operations analyst at a company that uses Microsoft Sentinel. You have enabled User and Entity Behavior Analytics (UEBA) to detect anomalies. A new alert fires indicating a user is logging in from an unusual location. However, the user is a known traveler. How can you reduce false positives without disabling the UEBA rule?

Accepted Answer

Add the user to the entity behavior analytics exclusion list.. Option A is correct because Microsoft Sentinel's UEBA allows you to add specific users to an entity behavior analytics exclusion list. This prevents the UEBA engine from generating alerts for that user's anomalous activities, such as logins from unusual locations, without disabling the underlying detection rule. This approach maintains detection coverage for other users while suppressing false positives for known travelers.

Answer

Disable the UEBA anomaly rule for unusual locations.

Answer

Change the alert severity to Informational.

Answer

Increase the lookback period for the anomaly detection.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Copilot for Security. You want to improve incident response efficiency. Which THREE features should you implement? (Choose three.)

Accepted Answer

Enable Microsoft Copilot for Security to assist with incident investigations.. Option A is correct because Microsoft Copilot for Security integrates directly with Microsoft Sentinel to provide AI-driven natural language assistance for incident investigations, enabling analysts to query data, summarize incidents, and generate KQL queries without manual scripting. This directly improves incident response efficiency by reducing investigation time and cognitive load.

Answer

Use watchlists to track known malicious IP addresses.

Answer

Configure workbooks to display real-time incident trends.

Question 14

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to reduce data ingestion costs while retaining security events for one year. You have enabled Azure Monitor Agent on all servers. What should you do?

Accepted Answer

Configure a daily ingestion cap and enable Basic Logs for the workspace.. Option B is correct because configuring a daily ingestion cap limits the total data ingested per day, directly controlling costs. Enabling Basic Logs for the workspace allows you to store security events at a lower ingestion cost while retaining them for up to one year, as Basic Logs support up to 365 days of retention by default. This combination meets the requirement to reduce costs and retain security events for one year without losing data.

Answer

Configure a daily ingestion cap and enable archiving for data older than 90 days.

Answer

Set a daily ingestion cap and convert the workspace to Auxiliary Logs.

Answer

Reduce the data retention period to 90 days and set a daily ingestion cap.

Question 15

Refer to the exhibit. A KQL query is used in a Microsoft Sentinel scheduled analytics rule to detect unhealthy agents. The rule runs every 5 minutes and has a lookback period of 5 minutes. What is the potential issue?

Accepted Answer

The query may miss agents with no heartbeat in the last 5 minutes due to the lookback period matching the run frequency.. Option C is correct because the rule runs every 5 minutes with a 5-minute lookback, creating a gap: if an agent sends a heartbeat at 0:01 and the rule runs at 0:05, the heartbeat falls within the lookback window. However, if the agent misses a heartbeat cycle (e.g., heartbeat interval is 10 minutes), the rule may not detect the absence because the lookback window only covers the last 5 minutes, and the last heartbeat might be older than 5 minutes. This means agents with no heartbeat in the last 5 minutes could be missed, especially if the heartbeat interval is longer than the lookback period.

Answer

The query will return all computers as unhealthy because the threshold is too high.

Answer

The query will not return any results because Heartbeat data is not in the workspace.

Answer

The query will cause a runtime error because ago() is misused.

Question 16

You are the security analyst for a company that uses Microsoft Sentinel. You notice that a critical analytics rule has not generated any incidents in the past week, but you know that relevant logs are being ingested. You need to troubleshoot why the rule is not firing. What is the first step you should take?

Accepted Answer

Run the analytics rule's query directly in Log Analytics to see if it returns results.. Option D is correct because the first step in troubleshooting a Sentinel analytics rule that is not generating incidents despite relevant logs being ingested is to run the rule's query directly in Log Analytics. This isolates whether the issue is with the query logic itself (e.g., syntax errors, time range misconfiguration, or data not matching the KQL conditions) rather than with data ingestion or rule settings. If the query returns results in Log Analytics, the problem lies elsewhere; if it returns no results, the query needs adjustment.

Answer

Check the incident creation rule configuration.

Answer

Verify that the log sources are connected and sending data to the workspace.

Answer

Disable and re-enable the analytics rule.

Question 17

Your security team uses Microsoft Defender XDR. You need to ensure that a user who is suspected of credential theft is immediately blocked from accessing corporate email and cloud apps, while the investigation continues. What should you do?

Accepted Answer

Use Microsoft Defender for Cloud Apps to suspend the user. Option B is correct because suspending the user in Microsoft Defender for Cloud Apps immediately revokes the user's access tokens and active sessions for cloud apps, blocking further access to corporate email and cloud apps without deleting the account. This allows the investigation to continue while the user is isolated, which is the precise requirement for a suspected credential theft scenario.

Answer

Create a conditional access policy in Microsoft Entra ID to block the user

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password from Microsoft Entra ID

Question 18

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malware to quarantine before delivery. Which policy type should you use?

Accepted Answer

Antimalware policy.. Antimalware policies in Microsoft Defender for Office 365 are specifically designed to scan inbound and outbound email messages for malware (e.g., viruses, worms, trojans) and automatically quarantine detected threats before delivery. This policy type uses the built-in malware detection engine to inspect attachments and message bodies, ensuring malicious content is blocked at the transport layer.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 19

Your organization plans to implement Microsoft Sentinel. Which THREE components are required for a basic deployment? (Choose three.)

Accepted Answer

Analytics rules to generate incidents.. Analytics rules are required to generate incidents from the data ingested into Microsoft Sentinel. Without analytics rules, the raw log data remains unprocessed and no security incidents are created, making the deployment non-functional for detection and response.

Answer

User and Entity Behavior Analytics (UEBA) enabled.

Answer

Bookmarks for incident investigations.

Question 20

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?

Accepted Answer

Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.. Option A is correct because when a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.

Answer

Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.

Answer

Check that the user who configured the connector has the Microsoft Sentinel Contributor role.

Answer

Ensure the firewall is registered in Azure Policy as a compliant resource.